PHP Vulnerabilities Discovered by AI Expose Websites to Remote Execution Attacks

Two critical remote code execution vulnerabilities in the PHP programming language were disclosed on October 21, 2026, after remaining undetected for over a decade. ColombiaOne.com reported that the flaws allow hackers to breach vulnerable servers and gain full control over affected systems. Security agencies have urged organizations to immediately update their installations as researchers detect active exploitation attempts. [1]

The memory safety vulnerabilities affect PHP versions 5.4 through 8.5, enabling remote code execution on target website hosts. The flaws were identified in August 2026 with the assistance of artificial intelligence tools, and details were publicly released on October 20, 2026. At the time of disclosure, the issues were estimated to impact nearly 70 percent of all websites. [3]

Maintainers issued emergency patches on October 21, 2026, covering PHP versions 8.2, 8.3, 8.4, and 8.5 along with detailed vulnerability information. ColombiaOne.com and the International Business Times UK both report that industry experts refer to the wider series of software flaws and digital security incidents in October 2026 as Black October. [1][2][3]